How to fix Error 586 on Windows 11

by

Why This Error Happens

Error 586 occurs when an operation—such as changing the domain password policy, modifying certain security settings, or running specific administrative commands—is attempted on a domain controller that does not hold the PDC Emulator FSMO role. Windows restricts these operations to the PDC Emulator by design, since it is the authoritative source for time synchronization, password changes, and account lockout processing within the domain. This typically happens when an admin uses RSAT tools on a Windows 11 machine but targets the wrong domain controller, or when the FSMO role has been transferred/seized and cached credentials/DNS records still point to the old PDC.

Step-by-Step Resolution Guide

  1. Identify the current PDC Emulator by opening an elevated Command Prompt on your Windows 11 machine (with RSAT installed) and running:
   netdom query fsmo

Note the server listed next to “PDC.”

  1. Verify RSAT connectivity — open Active Directory Users and Computers (dsa.msc), right-click the domain node, select Change Domain Controller, and manually select the DC identified as the PDC Emulator.

  2. Retry the failed operation (e.g., password policy edit, net accounts command, or domain trust modification) while explicitly connected to the PDC Emulator.

  3. If the PDC role was recently transferred/seized, flush DNS and clear cached credentials on the Windows 11 client:

   ipconfig /flushdns
   klist purge

Then re-run netdom query fsmo to confirm the role owner is correctly reflected before retrying.

  1. If the original PDC is offline or decommissioned, use Active Directory Users and Computers or ntdsutil on a healthy DC to formally seize the PDC Emulator role, ensuring the old server’s metadata is cleaned up with ntdsutil metadata cleanup.

Alternative or Verification Steps

  • Run dcdiag /test:fsmocheck from an elevated prompt to confirm the FSMO role holder is reachable and consistent across the domain.
  • If the error persists on a specific tool (e.g., ADUC snap-in), close and reopen the console after manually binding to the correct PDC via Change Domain Controller, as cached bindings can cause stale role errors.